There has been a persistent attack on GitHub repos by agents trying to land a commit to become a contributor. The default GitHub permission is to allow contributors to execute actions against the repo’s compute budget, so it could be a botnet. Another possibility is that they are trying to get a Copilot grant. Someone claiming to be in academia was surveying repos when that program first started. I’m guessing the permissions for that are equally as naive.